Privacy notice

Who is responsible for your data

The controller for the data processed through Visaroy is Visaroy (operator, to be confirmed). The registered legal entity and its address are being finalised and will be published here before launch. Until then, you can reach us about any privacy matter at contact@visaroy.app.

What we process

We built Visaroy to keep sensitive identity data transient. The following describes what is handled and where it lives:

• Passport and document contents (names, dates, numbers, and the document images you upload) are processed in memory during your session to extract details and fill the official form. They are sent to our language-model processor for extraction and are never written to our database. AI requests are not used to train models. Providers may retain requests for abuse monitoring under their own terms. A model also checks that the answers we save match what you wrote, and that the details we read from your documents, such as the name on a bank statement, match your answers.
• Progress saved on your device. This browser keeps your answers, chat and document checks in its storage, so a refresh or a closed tab doesn't lose them. They stay until you choose Start again or clear your browser data. Visaroy doesn't save your files. It keeps only each file's name, size and a fingerprint, so it can recognise the file when you attach it again. We receive none of this except in the requests needed to extract data, validate documents, or generate your pack.
• Anonymous session record. We store an anonymous session identifier in our database (Neon) so your session and our rate limits work. It contains no application, profile, or document content. There is currently no way to save an application to our servers.
• Anonymous usage and error data. We record cookieless, anonymous product-analytics events and error reports (for example, which steps were reached and whether an error occurred) using an opaque session identifier. These never include your passport or document contents.

Processors we rely on

We use the following third-party processors to run the service. We share with each one only what that service needs for its stated purpose.

• Vercel AI Gateway Routes chat, document-extraction and cover-letter requests to the language models that read your answers and uploaded documents. AI requests are not used to train models. Providers may retain requests for abuse monitoring under their own terms. A model also checks that the answers we save match what you wrote, and that the details we read from your documents, such as the name on a bank statement, match your answers.United States / global model providers
• PostHog (EU Cloud) Cookieless product analytics and error monitoring. Receives anonymous usage events and an opaque session id, never your passport or document contents.European Union
• Neon Managed Postgres database that stores your anonymous session record (for sign-in continuity and rate limiting). It contains no application or document content.European Union / United States (configurable)
• OpenStreetMap Nominatim Looks up accommodation addresses you enter so the form can be filled with a validated address.European Union (OpenStreetMap Foundation)
• Railway Hosts and serves the application and processes requests, including document uploads.Amsterdam, Netherlands (European Union)

AI processing

AI requests are not used to train models. Providers may retain requests for abuse monitoring under their own terms. A model also checks that the answers we save match what you wrote, and that the details we read from your documents, such as the name on a bank statement, match your answers.

How long we keep data

Passport and document contents used only to fill the form are processed in memory and are not retained by us after your session, beyond any transient processing logs held by our processors under their own terms. Saved profiles and applications are kept until you delete them or ask us to delete them. Anonymous analytics and error data are retained for a limited period for product and reliability purposes. Exact retention periods will be confirmed in the final notice.

Your rights and how to contact us

Depending on where you live, you may have rights to access, correct, delete, or export your data, to restrict or object to processing, and to lodge a complaint with your data protection authority. To exercise any of these rights, or to ask us anything about how your data is handled, contact contact@visaroy.app. You can also reach us through the contact page.